Wireshark · Wireshark-users: Re: [Wireshark-users] Yum install centos 5.2

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 11, 2009, at 3:01 PM, Mike Brandonisio wrote:

> This is the output I'm getting
>
>  0.090293 74.xx.xx.xx -> 64.xx.xx.xx   SMTP C: EHLO host22.example.com
>
> That is exactly what I'm looking for.
>
> How can I can narrow the filter only those that contain 'SMTP'?

"Contain 'SMTP'" in what sense?  Port 25 traffic normally "contains  
SMTP" in the sense that the traffic going to or from TCP port 25 is  
almost always SMTP traffic (nothing absolutely *prevents* non-SMTP  
traffic to be sent on port 25, but it's not usually done.

Or do you mean "only those that contain 'HELO' or 'EHLO'"?  That's  
trickier, but it should be possible, even with a capture filter - you  
want TCP segments where the payload begins with "HELO" or "EHLO".

If there are no TCP options, then

	tcp[20:4] = 0x48454c4f or tcp[20:4] = 0x45484c4f

will match all segments beginning with HELO or EHLO, so

	tcp port 25 and src host 74.xx.xx.xx and (tcp[20:4] = 0x48454c4f or  
tcp[20:4] = 0x45484c4f)

should work as a capture filter.  If there are TCP options, it'd be a  
little more complicated, as "20" would have to be replaced by the  
length of the TCP header (it can be done, I'd just have to spend some  
more time figuring it out).

One of these days I may look at adding some libpcap syntax to do  
string matching and matching on TCP/UDP payload contents.